diff --git a/modules/logging-bucket/README.md b/modules/logging-bucket/README.md
index c8ad5d8d2..abd1a4fd2 100644
--- a/modules/logging-bucket/README.md
+++ b/modules/logging-bucket/README.md
@@ -118,17 +118,18 @@ module "bucket" {
 
 | name | description | type | required | default |
 |---|---|:---:|:---:|:---:|
-| [name](variables.tf#L61) | Name of the logging bucket. | <code>string</code> | ✓ |  |
-| [parent](variables.tf#L66) | ID of the parent resource containing the bucket in the format 'project_id' 'folders/folder_id', 'organizations/organization_id' or 'billing_account_id'. | <code>string</code> | ✓ |  |
+| [name](variables.tf#L71) | Name of the logging bucket. | <code>string</code> | ✓ |  |
+| [parent](variables.tf#L76) | ID of the parent resource containing the bucket in the format 'project_id' 'folders/folder_id', 'organizations/organization_id' or 'billing_account_id'. | <code>string</code> | ✓ |  |
 | [context](variables.tf#L17) | Context-specific interpolations. | <code title="object&#40;&#123;&#10;  custom_roles   &#61; optional&#40;map&#40;string&#41;, &#123;&#125;&#41;&#10;  folder_ids     &#61; optional&#40;map&#40;string&#41;, &#123;&#125;&#41;&#10;  iam_principals &#61; optional&#40;map&#40;string&#41;, &#123;&#125;&#41;&#10;  kms_keys       &#61; optional&#40;map&#40;string&#41;, &#123;&#125;&#41;&#10;  locations      &#61; optional&#40;map&#40;string&#41;, &#123;&#125;&#41;&#10;  project_ids    &#61; optional&#40;map&#40;string&#41;, &#123;&#125;&#41;&#10;  tag_values     &#61; optional&#40;map&#40;string&#41;, &#123;&#125;&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>&#123;&#125;</code> |
 | [description](variables.tf#L32) | Human-readable description for the logging bucket. | <code>string</code> |  | <code>null</code> |
 | [kms_key_name](variables.tf#L38) | To enable CMEK for a project logging bucket, set this field to a valid name. The associated service account requires cloudkms.cryptoKeyEncrypterDecrypter roles assigned for the key. | <code>string</code> |  | <code>null</code> |
 | [location](variables.tf#L44) | Location of the bucket. | <code>string</code> |  | <code>&#34;global&#34;</code> |
-| [log_analytics](variables.tf#L50) | Enable and configure Analytics Log. | <code title="object&#40;&#123;&#10;  enable          &#61; optional&#40;bool, false&#41;&#10;  dataset_link_id &#61; optional&#40;string&#41;&#10;  description     &#61; optional&#40;string, &#34;Log Analytics Dataset&#34;&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>&#123;&#125;</code> |
-| [parent_type](variables.tf#L74) | Parent object type for the bucket (project, folder, organization, billing_account). | <code>string</code> |  | <code>&#34;project&#34;</code> |
-| [retention](variables.tf#L81) | Retention time in days for the logging bucket. | <code>number</code> |  | <code>30</code> |
-| [tag_bindings](variables.tf#L87) | Tag bindings for this bucket, in key => tag value id format. | <code>map&#40;string&#41;</code> |  | <code>&#123;&#125;</code> |
-| [views](variables.tf#L94) | Log views for this bucket. | <code title="map&#40;object&#40;&#123;&#10;  filter      &#61; string&#10;  location    &#61; optional&#40;string&#41;&#10;  description &#61; optional&#40;string&#41;&#10;  iam         &#61; optional&#40;map&#40;list&#40;string&#41;&#41;, &#123;&#125;&#41;&#10;  iam_bindings &#61; optional&#40;map&#40;object&#40;&#123;&#10;    members &#61; list&#40;string&#41;&#10;    condition &#61; optional&#40;object&#40;&#123;&#10;      expression  &#61; string&#10;      title       &#61; string&#10;      description &#61; optional&#40;string&#41;&#10;    &#125;&#41;&#41;&#10;  &#125;&#41;&#41;, &#123;&#125;&#41;&#10;  iam_bindings_additive &#61; optional&#40;map&#40;object&#40;&#123;&#10;    member &#61; string&#10;    role   &#61; string&#10;    condition &#61; optional&#40;object&#40;&#123;&#10;      expression  &#61; string&#10;      title       &#61; string&#10;      description &#61; optional&#40;string&#41;&#10;    &#125;&#41;&#41;&#10;  &#125;&#41;&#41;, &#123;&#125;&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
+| [locked](variables.tf#L50) | Whether the bucket is locked. Locked buckets may only be deleted if they are empty. This can only be set for project-level buckets. | <code>bool</code> |  | <code>null</code> |
+| [log_analytics](variables.tf#L60) | Enable and configure Analytics Log. | <code title="object&#40;&#123;&#10;  enable          &#61; optional&#40;bool, false&#41;&#10;  dataset_link_id &#61; optional&#40;string&#41;&#10;  description     &#61; optional&#40;string, &#34;Log Analytics Dataset&#34;&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>&#123;&#125;</code> |
+| [parent_type](variables.tf#L84) | Parent object type for the bucket (project, folder, organization, billing_account). | <code>string</code> |  | <code>&#34;project&#34;</code> |
+| [retention](variables.tf#L91) | Retention time in days for the logging bucket. | <code>number</code> |  | <code>30</code> |
+| [tag_bindings](variables.tf#L97) | Tag bindings for this bucket, in key => tag value id format. | <code>map&#40;string&#41;</code> |  | <code>&#123;&#125;</code> |
+| [views](variables.tf#L104) | Log views for this bucket. | <code title="map&#40;object&#40;&#123;&#10;  filter      &#61; string&#10;  location    &#61; optional&#40;string&#41;&#10;  description &#61; optional&#40;string&#41;&#10;  iam         &#61; optional&#40;map&#40;list&#40;string&#41;&#41;, &#123;&#125;&#41;&#10;  iam_bindings &#61; optional&#40;map&#40;object&#40;&#123;&#10;    members &#61; list&#40;string&#41;&#10;    condition &#61; optional&#40;object&#40;&#123;&#10;      expression  &#61; string&#10;      title       &#61; string&#10;      description &#61; optional&#40;string&#41;&#10;    &#125;&#41;&#41;&#10;  &#125;&#41;&#41;, &#123;&#125;&#41;&#10;  iam_bindings_additive &#61; optional&#40;map&#40;object&#40;&#123;&#10;    member &#61; string&#10;    role   &#61; string&#10;    condition &#61; optional&#40;object&#40;&#123;&#10;      expression  &#61; string&#10;      title       &#61; string&#10;      description &#61; optional&#40;string&#41;&#10;    &#125;&#41;&#41;&#10;  &#125;&#41;&#41;, &#123;&#125;&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
 
 ## Outputs
 
diff --git a/modules/logging-bucket/main.tf b/modules/logging-bucket/main.tf
index c5f2bca6c..0c1148a6d 100644
--- a/modules/logging-bucket/main.tf
+++ b/modules/logging-bucket/main.tf
@@ -51,6 +51,7 @@ resource "google_logging_project_bucket_config" "bucket" {
   bucket_id        = var.name
   description      = var.description
   enable_analytics = var.log_analytics.enable
+  locked           = var.locked
   dynamic "cmek_settings" {
     for_each = var.kms_key_name == null ? [] : [""]
     content {
diff --git a/modules/logging-bucket/variables.tf b/modules/logging-bucket/variables.tf
index c5938c818..3cc60d55b 100644
--- a/modules/logging-bucket/variables.tf
+++ b/modules/logging-bucket/variables.tf
@@ -47,6 +47,16 @@ variable "location" {
   default     = "global"
 }
 
+variable "locked" {
+  description = "Whether the bucket is locked. Locked buckets may only be deleted if they are empty. This can only be set for project-level buckets."
+  type        = bool
+  default     = null
+  validation {
+    condition     = var.parent_type == "project" || var.locked == null
+    error_message = "The 'locked' attribute can only be set for project-level buckets."
+  }
+}
+
 variable "log_analytics" {
   description = "Enable and configure Analytics Log."
   type = object({